Wu-imapd部分Mailbox属性远程缓冲区溢出漏洞

漏洞信息详情

Wu-imapd部分Mailbox属性远程缓冲区溢出漏洞

漏洞简介

Wu-imapd是一款由Washington University开发的IMAP(Internet Message Access Protocol)服务实现,可使用在Linux和Unix操作系统下。
Wu-imapd在处理部分Mailbox属性请求时存在漏洞,可导致远程攻击者进行缓冲区溢出攻击,以Imapd进程的权限在目标系统上执行任意命令。
攻击者可以构建不正常的获取部分邮箱属性的请求,导致服务程序产生SIG11错误。问题存在于imapd.c中:
imapd.c
——-
int main (int argc,char *argv[])
{
unsigned long i,uid;
long f;
char *s,*t,*u,*v,tmp[MAILTMPLEN];
.
.
.
else if (!strncmp (t,\”BODY[\”,5) && (v = strchr(t+5,\’\’]\’\’)) &&
!v[1]){
strncpy (tmp,t+5,i = v – (t+5));
.
.
.
else if (!strncmp (t,\”BODY.PEEK[\”,10) &&
(v = strchr (t+10,\’\’]\’\’)) && !v[1]) {
strncpy (tmp,t+10,i = v – (t+10));
.
.
.
——-
处理A0666 PARTIAL 1 BODY[AAA…1052bytes..AAA] 1 1 请求时会产生缓冲溢出,精心构建字符串数据可导致以imapd进程的权限在目标系统上执行任意命令。
此漏洞只影响支持RFC 1730的imapd,在imapd 2001.313和imap-2001.315.默认不安装对此RFC的支持。
要判断是否imapd存在此漏洞,可运行imap后执行\”x capability\”,信息如下所示:
下面示例表示有漏洞的服务程序(请暂时停止imapd服务):
* PREAUTH …..
x capability
* CAPABILITY IMAP4 IMAP4REV1 …
x OK CAPABILITY completed

下面示例表示不存在漏洞的服务程序:
* PREAUTH …..
x capability
* CAPABILITY IMAP4REV1 …
x OK CAPABILITY completed

漏洞公告

厂商补丁:
Caldera
——-
Caldera已经为此发布了一个安全公告(CSSA-2002-021.0)以及相应补丁:

CSSA-2002-021.0:Linux: imapd buffer overflow when fetching partial mailbox attributes

链接:http://www.caldera.com/support/security/advisories/CSSA-2002-021.0.txt” target=”_blank”>
http://www.caldera.com/support/security/advisories/CSSA-2002-021.0.txt

补丁下载:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

补丁安装:

# rpm -Fvh package_name
Conectiva
———
Conectiva已经为此发布了一个安全公告(CLA-2002:487)以及相应补丁:

CLA-2002:487:imap

链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000487” target=”_blank”>
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000487

补丁下载:

ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/imap-2000c-10U60_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-devel-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-devel-static-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-doc-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/imap-2000c-10U70_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-devel-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-devel-static-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-doc-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/SRPMS/imap-2000c-12U8_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-devel-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-devel-static-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-doc-2000c-12U8_2cl.i386.rpm

Conectiva Linux version 6.0及以上版本的用户可以使用apt进行RPM包的更新:

– 把以下的文本行加入到/etc/apt/sources.list文件中:

rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(如果你不是使用6.0版本,用合适的版本号代替上面的6.0)

– 执行: apt-get update

– 更新以后,再执行: apt-get upgrade
MandrakeSoft
————
MandrakeSoft已经为此发布了一个安全公告(MDKSA-2002:034)以及相应补丁:

MDKSA-2002:034:imap

链接:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php” target=”_blank”>
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php

补丁下载:

Updated Packages:

Linux-Mandrake 7.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/RPMS/imap-2000c-4.9mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/RPMS/imap-devel-2000c-4.9mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/SRPMS/imap-2000c-4.9mdk.src.rpm

Linux-Mandrake 7.2:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/RPMS/imap-2000c-4.8mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/RPMS/imap-devel-2000c-4.8mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/SRPMS/imap-2000c-4.8mdk.src.rpm

Mandrake Linux 8.0:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/imap-2000c-4.7mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/imap-devel-2000c-4.7mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/SRPMS/imap-2000c-4.7mdk.src.rpm

Mandrake Linux 8.0/ppc:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/RPMS/imap-2000c-4.7mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/RPMS/imap-devel-2000c-4.7mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/SRPMS/imap-2000c-4.7mdk.src.rpm

Mandrake Linux 8.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/imap-2000c-7.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/


参考网址

来源:US-CERT Vulnerability Note: VU#961489
名称: VU#961489
链接:http://www.kb.cert.org/vuls/id/961489

来源: BUGTRAQ
名称: 20020510 wu-imap buffer overflow condition
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=102107222100529&w=2

来源: XF
名称: wuimapd-authenticated-user-bo(10803)
链接:http://xforce.iss.net/xforce/xfdb/10803

来源: www.washington.edu
链接:http://www.washington.edu/imap/buffer.html

来源: BID
名称: 4713
链接:http://www.securityfocus.com/bid/4713

来源: REDHAT
名称: RHSA-2002:092
链接:http://www.redhat.com/support/errata/RHSA-2002-092.html

来源: ENGARDE
名称: ESA-20020607-013
链接:http://www.linuxsecurity.com/advisories/other_advisory-2120.html

来源: MANDRAKE
名称: MDKSA-2002:034
链接:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php

来源: XF
名称: wuimapd-partial-mailbox-bo(9055)
链接:http://www.iss.net/security_center/static/9055.php

来源: HP
名称: HPSBTL0205-043
链接:http://online.securityfocus.com/advisories/4167

来源: CONECTIVA
名称: CLA-2002:487
链接:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000487

来源: CALDERA
名称: CSSA-2002-021.0
链接:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-021.0.txt

© 版权声明
THE END
喜欢就支持一下吧
点赞0 分享